User manual ASUS MS208D

[. . . ] The IKE IPSec tunnel ends at the Internet Security Router and PC2. Note that in the actual applications, the Internet Security Router and the Windows 2000/XP PC are most likely connected via the Internet instead of a switch as shown in Figure 2. 1. 7x Ethernet C 7 8 9 101112 A 12 34 56 1x 2x 3x 4x 5x 6x 1x 2x 3x 4x 5x 6x 8x 9x 10x 11x 12x 7x 8x 9x 10x 11x 12x Switch A B Internet Security Router WAN: 192. 168. 18. 146 PC2: 192. 168. 19. 166 LAN: 192. 168. 1. 1 PC1: 192. 168. 1. 10 Windows 2000/XP Figure 2. 1. Network Diagram 2. 1 Configure the IP Address of the Windows PC ­ PC2 1. Open the "Internet Protocol (TCP/IP) Properties" dialog box a) For Windows 2000, click on "Start" è select "Settings" è click on "Network and Dial-up Connections" icon è right click on "Local Area Connection" icon or the icon that represents your PC's network card è select "Properties" è double click on "Internet Protocol (TCP/IP)". [. . . ] Select "The tunnel endpoint is specified by this IP address:", enter "192. 168. 18. 146" as the tunnel endpoint for this rule and then click the "Next" button to continue. 9. Select "All network connections" as the network type and then click the "Next" button to continue. Copyright 2003, ASUSTeK Computer, Inc. Page 11 APPLICATION NOTES ­ CREATING AN IKE IPSEC TUNNEL BETWEEN AN INTERNET SECURITY ROUTER AND A WINDOWS 2000/XP PC 10. Select "Use this string to protect the key exchange (preshared key):" as the authentication method and enter "1234" as the preshared key. Make sure that this preshared key matches what is configured for the Internet Security Router. To make it more secure, you may choose a longer string. Note that you must not use a blank string for the preshared key. Click the "Next" button to continue. 11. In the IP Filter List dialog box, click the "Add" button. A list of IP filter is displayed. Copyright 2003, ASUSTeK Computer, Inc. Page 12 APPLICATION NOTES ­ CREATING AN IKE IPSEC TUNNEL BETWEEN AN INTERNET SECURITY ROUTER AND A WINDOWS 2000/XP PC 12. Name your filter "WIN_SL1000" and click the "Add" button to continue. 13. Select "My IP Address" as the Source address, select "A specific IP Subnet" and enter "192. 168. 1. 0/255. 255. 255. 0" as the Destination address. Name your filter, "SL1000_WIN", and click the "Add" button to continue. Copyright 2003, ASUSTeK Computer, Inc. Page 22 APPLICATION NOTES ­ CREATING AN IKE IPSEC TUNNEL BETWEEN AN INTERNET SECURITY ROUTER AND A WINDOWS 2000/XP PC 8. Select "A specific IP Subnet" from the "Source address:" drop-down list and enter "192. 168. 1. 0/255. 255. 255. 0" as the Source address and select "My IP Address" as the Destination address. Clear the "Mirrored" check box and then click the "OK" button to continue. Make sure "Mirrored" check box is cleared. 9. Click the "Close" button to close the "IP Filter List" dialog box. Copyright 2003, ASUSTeK Computer, Inc. Page 23 APPLICATION NOTES ­ CREATING AN IKE IPSEC TUNNEL BETWEEN AN INTERNET SECURITY ROUTER AND A WINDOWS 2000/XP PC 10. In the "Security Rule Wizard" dialog box, select the newly created security rule, "SL1000_WIN", and click the "Next" button to configure Filter Action. Select this item. 11. VPN Policy Configuration Settings After the new VPN policy is created, you can see it displayed in the "Site to Site Access List Rules" as shown in Figure 3. 2. New VPN policy Figure 3. 2. Verify the New VPN Policy 3. 3. 2 Configure an Outbound ACL Rule for the VPN Policy This step is needed only when firewall is enabled. To allow outbound traffic to pass through the firewall, an outbound ACL rule is required; otherwise, the outbound traffic will be blocked by the firewall. Click the "Firewall" Copyright 2003, ASUSTeK Computer, Inc. Page 28 APPLICATION NOTES ­ CREATING AN IKE IPSEC TUNNEL BETWEEN AN INTERNET SECURITY ROUTER AND A WINDOWS 2000/XP PC menu and then click the "Outbound ACL" submenu to access the Outbound ACL configuration page. [. . . ] However, ping alone cannot tell what is wrong with the connection if there is a problem with the connection. You can open a "Command Prompt" window, as shown in the following figure, and ping PC1 from PC2 by entering "ping 192. 168. 1. 10" (assuming IP of PC1 is 192. 168. 1. 10) or ping PC2 from PC1 by entering "ping 192. 168. 19. 166" at the command prompt to check if the VPN connection is established. You will receive several "Negotiating IP Security" responses initially (if you ping PC1 from PC2) during the negotiation of IPSec VPN tunnel. Repeat the "ping" command, and you will receive successful ping responses in a few more tries. Copyright 2003, ASUSTeK Computer, Inc. Page 30 APPLICATION NOTES ­ CREATING AN IKE IPSEC TUNNEL BETWEEN AN INTERNET SECURITY ROUTER AND A WINDOWS 2000/XP PC Ping response during negotiation of the VPN tunnel. Successful Ping response. Figure 4. 1. [. . . ]